Abstract
Many believe that the recent emphasis on enterprise risk management function is misguided, especially after the failure of sophisticated quantitative risk models during the global financial crisis. The concern is that top-down risk management will inhibit innovation and entrepreneurial activities. We advocate, however, that risk management done well-identifying, assessing, and mitigating risks in a cost-efficient manner-allows firms to add value by taking on riskier projects and strategies. But risk management must overcome severe individual and organizational biases that prevent managers and employees from thinking deeply and analytically about their risk exposure. In the paper, we reason inductively, from seven case studies, to propose multiple ways for the corporate risk function to foster highly interactive and intrusive dialogues that surface and prioritize risks, help to allocate resources to mitigate them, and bring clarity to the value trade-offs and moral dilemmas that lurk in those decisions.

Abstract
This paper, based on a five-year longitudinal study at two UK-based banks, documents and analyzes the practices used by risk managers as they interact and communicate with managers in their organizations. Specifically, we examine how risk managers (1) establish and maintain interpersonal connections with decision makers; and how they (2) adopt, deploy and reconfigure tools-practices that we define collectively as toolmaking. Using prior literature and our empirical observations, we distinguish between activities to which toolmaking was not central, and those to which toolmaking was important. Our study contributes to the accounting and management literature by highlighting the central role of toolmaking in explaining how functional experts may compete for the attention of decision makers in the intraorganizational marketplace for managerially relevant information. Specifically, as risk management becomes more tool-driven and toolmaking may become more prevalent, our study provides a more nuanced understanding of the nature and consequences of risk management in contemporary organizations. An explicit focus on toolmaking extends accounting research that has hitherto focused attention on the structural arrangements and interpersonal connections when explaining how functional experts can become influential.

Abstract
Academics are increasingly examining the adoption and impact of ERM, but the studies are inconsistent and inconclusive, due, we believe, to an inadequate specification of how ERM is used in practice. Based on a ten-year field project and over 250 interviews with senior risk officers, we put forward a contingency theory of ERM, identifying potential design parameters that can explain observable variation in the "ERM mix" adopted by organizations. We also add a new contingent variable: the type of risk that a specific ERM practice addresses. We outline a "minimum necessary contingency framework" (Otley 1980) that is sufficiently nuanced, while still empirically observable, that empirical researchers may, in due course, hypothesize about "fit" between contingent variables, such as risk types and the ERM mix, as well as about outcomes such as organizational effectiveness.

Abstract
n theory, the risk management groups of two British banks-Saxon and Anglo had the same influence in their organizations. But in practice, they did not: Saxon's was engaged in critical work throughout the bank, while Anglo's had little visibility outside its areas of expertise.¦In their study of these two financial institutions, the authors identified four competencies trailblazing, toolmaking, teamwork, and translation that help functional leaders or groups compete for top management's limited attention and increase their impact.¦Anglo's risk managers were strong in only some of the competencies, but Saxon's were strong in all four. They consistently scanned the internal and external environment for important issues to which they could apply a risk management perspective (trailblazing) and then developed tools such as quarterly risk reports that spread their expertise (toolmaking). While controlling the tools' design and implementation, the risk managers incorporated business managers' insights (teamwork) and made sure everyone could understand the findings (translation).¦Ultimately, experts' roles must fit the organization's strategy and structural needs. In some situations, functional experts can raise their profile by cultivating just two of the competencies. But those who are strong in all four are likely to be the most influential.

Abstract
Risk management is too-often treated as a compliance issue that can be solved by drawing up lots of rules and making sure that all employees follow them. Many such rules, of course, are sensible and do reduce some risks that could severely damage a company. But rules-based risk management will not diminish either the likelihood or the impact of a disaster such as Deepwater Horizon, just as it did not prevent the failure of many financial institutions during the 2007-2008 credit crisis.¦In this article, Robert S. Kaplan and Anette Mikes present a categorization of risk that allows executives to understand the qualitative distinctions between the types of risks that organizations face. Preventable risks, arising from within the organization, are controllable and ought to be eliminated or avoided. Examples are the risks from employees' and managers' unauthorized, unethical, or inappropriate actions and the risks from breakdowns in routine operational processes. Strategy risks are those a company voluntarily assumes in order to generate superior returns from its strategy. External risks arise from events outside the company and are beyond its influence or control. Sources of these risks include natural and political disasters and major macroeconomic shifts. Risk events from any category can be fatal to a company's strategy and even to its survival.¦Companies should tailor their risk management processes to these different risk categories. A rules-based approach is effective for managing preventable risks, whereas strategy risks require a fundamentally different approach based on open and explicit risk discussions. To anticipate and mitigate the impact of major external risks, companies can call on tools such as war-gaming and scenario analysis.

Abstract
For two decades, risk management has been gaining ground in banking. In light of the recent financial crisis, several commentators concluded that the continuing expansion of risk measurement is dysfunctional (Power, 2009; Taleb, 2007). This paper asks whether the expansion of measurement-based risk management in banking is as inevitable and as dangerous as Power and others speculate. Based on two detailed case studies and 53 additional interviews with risk-management staff at five other major banks over 2001-2010, this paper shows that relentless risk measurement is contingent on what I call the "calculative culture" (Mikes, 2009a). While the risk functions of some organizations have a culture of quantitative enthusiasm and are dedicated to risk measurement, others, with a culture of quantitative scepticism, take a different path, focusing instead on risk envisionment, aiming to provide top management with alternative future scenarios and with expert opinions on emerging risk issues. In order to explain the dynamics of these alternative plots, I show that risk experts engage in various kinds of boundary-work (Gieryn, 1983, 1999), sometimes to expand and sometimes to limit areas of activity, legitimacy, authority, and responsibility.

Abstract
Risk management can add value through the continuous questioning of existing controls, strategies, and scenarios. The article outlines a new framework for risk management predicated on the notion of organizational learning, and illustrates it by a case study of a company that combined the strengths of a tripartite risk management function, deploying both independent and embedded risk managers.

Abstract
In the second article of our two-part series, we explore the concept of an Office of Risk Management along with a case study of an innovative risk management function at JP Morgan Private Bank. We also look at the "softer" components of risk management, including a comparison of two different, equally effective risk officer styles and roles.

Abstract
Five experts gathered recently to discuss the future of enterprise risk management: Kaplan, the Baker Foundation Professor at Harvard Business School, who with his colleague David Norton developed the balanced scorecard; Mikes, an assistant professor at HBS who studies the evolution of risk management and the role of the chief risk officer; Simons, the Charles M. Williams Professor of Business Administration at HBS; Tufano, the Sylvan C. Coleman Professor of Financial Management at HBS; and Hofmann, the chief risk officer at Koch Industries. The panel was moderated by HBR senior editor David Champion.¦Among the questions they addressed were: How predictable was the financial meltdown of 2008-2009? Did new tools for assessing risk give a false sense of security? How do the challenges facing industrial companies differ from those facing the financial sector? Is outsourcing an effective risk-management tool? Have capital structures become a bit too efficient in many companies? What makes a good chief risk officer?

Abstract
Enterprise risk management (ERM) has recently emerged as a widespread practice in financial institutions. It has been increasingly codified and encrypted into regulatory, corporate governance and organizational management blueprints. A burgeoning literature of regulatory and practitioner texts is indicative of the apparent diversity of ambitions, objectives and techniques that constitute the ERM agenda. Making sense of these developments is a challenge. This paper presents field-based evidence from two large banking organizations suggesting that systematic variations in ERM practices exist in the financial services industry. The cases illustrate four risk management ideal types and show how they form the 'risk management mix' in a given organization. Further, drawing on the literature of the roles and uses of management control systems (MCS), the paper explores how ERM achieved organizational significance in the studied settings. The findings are indicative of the current co-existence of alternative models of ERM. In particular, two types of ERM models are postulated: one driven by a strong shareholder value imperative (ERM by the numbers), the other corresponding to the demands of the risk-based internal control imperative (holistic ERM). This paper explains the differences in the two risk management mixes pointing towards alternative logics of calculation [Power, M.K., 2007. Organized Uncertainty-Designing a World of Risk Management. Oxford University Press, Oxford], which I conceptualise and describe as different calculative cultures. The study suggests that calculative cultures, which in these cases shaped managerial predilections towards ERM practices, are relevant, albeit so far neglected, constituents of the fit between MCS and organizational contexts.

Abstract
New regulatory requirements have raised the bar on compliance and significantly expanded the remit of risk management departments in financial institutions. The compliance imperative requires banks to implement a firm-wide risk management framework complete with analytical models for the measurement and control of quantifiable risks. In addition, recent corporate governance guidelines advocate the 'business partner' role of risk management, considering it a high-level strategic activity, contributing to board-level decisions, planning and performance management. This requires senior risk officers to understand and communicate key strategic uncertainties to senior management and the business lines. This paper assesses the roles of risk functions and, in particular, senior risk officers in 15 international banks. The research, carried out between June 2006 and June 2007, offers a snapshot of the state of risk management before the liquidity and credit crunch became apparent in the second half of 2007. The findings suggest that the role of chief risk officers (CROs) had expanded dramatically, with more than half of them frequently involved in firm-level strategic decisions. In the majority of these banks, however, various compliance and risk modelling initiatives were still works-in-progress at the onset of the market turmoil. CROs voiced divergent views on the uses, benefits and limitations of risk models, suggesting that they promoted different 'calculative cultures' ('quantitative enthusiasm' versus 'quantitative scepticism'). Fostering alternative calculative cultures, strategically involved CROs interpreted the 'business partner' role of their function differently. Some risk functions aspired for an influential expert voice in key business decisions, while others strived for the formal integration of risk management with performance management. The paper thus calls for a clarification of stakeholder expectations on risk management to reduce the danger of an expectations gap around particular risk management approaches that are adequate for certain banks but ill-suited for others.

Abstract
Making sense of operational risk practices in the financial services sector is a challenge. There is a temptation to explain the wide variety of approaches as a characteristic of the early stage of development in which the genre resides. Based on the evidence of three case studies, this paper explores the mechanisms that guide firms in their choice of operational risk methodologies. First, drawing on Power (2003a)'s notion of calculative cultures, we propose that senior risk officers develop 'personal philosophies' about the 'manageability' of risks. Second, we emphasise the role of institutionalised rules and conventions (Meyer and Rowan, 1977) in the selection and use of operational risk practices. The paper explicates a number of conventions that are being institutionalised in the operational risk area. The case studies draw attention to the conflicts between the demands of these multiple conventions, and how organisations struggle to resolve them.